diff --git a/[refs] b/[refs]
index bc2bf6b16257..0a93b6d2317f 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 74a920139a0f1119c5a604cef0ce5d6f591dc782
+refs/heads/master: da9c99fc32e2d84f80672d192a7aaf7239057a2e
diff --git a/trunk/arch/ia64/kvm/kvm-ia64.c b/trunk/arch/ia64/kvm/kvm-ia64.c
index 7f3c0a2e60cd..73c5c2b05f64 100644
--- a/trunk/arch/ia64/kvm/kvm-ia64.c
+++ b/trunk/arch/ia64/kvm/kvm-ia64.c
@@ -1802,8 +1802,7 @@ static int kvm_ia64_sync_dirty_log(struct kvm *kvm,
 {
 	struct kvm_memory_slot *memslot;
 	int r, i;
-	long base;
-	unsigned long n;
+	long n, base;
 	unsigned long *dirty_bitmap = (unsigned long *)(kvm->arch.vm_base +
 			offsetof(struct kvm_vm_data, kvm_mem_dirty_log));
 
@@ -1816,7 +1815,7 @@ static int kvm_ia64_sync_dirty_log(struct kvm *kvm,
 	if (!memslot->dirty_bitmap)
 		goto out;
 
-	n = kvm_dirty_bitmap_bytes(memslot);
+	n = ALIGN(memslot->npages, BITS_PER_LONG) / 8;
 	base = memslot->base_gfn / BITS_PER_LONG;
 
 	for (i = 0; i < n/sizeof(long); ++i) {
@@ -1832,7 +1831,7 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
 		struct kvm_dirty_log *log)
 {
 	int r;
-	unsigned long n;
+	int n;
 	struct kvm_memory_slot *memslot;
 	int is_dirty = 0;
 
@@ -1851,7 +1850,7 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
 	if (is_dirty) {
 		kvm_flush_remote_tlbs(kvm);
 		memslot = &kvm->memslots->memslots[log->slot];
-		n = kvm_dirty_bitmap_bytes(memslot);
+		n = ALIGN(memslot->npages, BITS_PER_LONG) / 8;
 		memset(memslot->dirty_bitmap, 0, n);
 	}
 	r = 0;
diff --git a/trunk/arch/m68k/include/asm/mcfuart.h b/trunk/arch/m68k/include/asm/mcfuart.h
index 01a8716c5fc5..ef2293873612 100644
--- a/trunk/arch/m68k/include/asm/mcfuart.h
+++ b/trunk/arch/m68k/include/asm/mcfuart.h
@@ -212,10 +212,5 @@ struct mcf_platform_uart {
 #define	MCFUART_URF_RXS		0xc0		/* Receiver status */
 #endif
 
-#if defined(CONFIG_M5272)
-#define MCFUART_TXFIFOSIZE	25
-#else
-#define MCFUART_TXFIFOSIZE	1
-#endif
 /****************************************************************************/
 #endif	/* mcfuart_h */
diff --git a/trunk/arch/m68knommu/Makefile b/trunk/arch/m68knommu/Makefile
index 14042574ac21..ce404bc9ccbd 100644
--- a/trunk/arch/m68knommu/Makefile
+++ b/trunk/arch/m68knommu/Makefile
@@ -94,7 +94,7 @@ cflags-$(CONFIG_M520x)		:= $(call cc-option,-mcpu=5208,-m5200)
 cflags-$(CONFIG_M523x)		:= $(call cc-option,-mcpu=523x,-m5307)
 cflags-$(CONFIG_M5249)		:= $(call cc-option,-mcpu=5249,-m5200)
 cflags-$(CONFIG_M5271)		:= $(call cc-option,-mcpu=5271,-m5307)
-cflags-$(CONFIG_M5272)		:= $(call cc-option,-mcpu=5272,-m5307)
+cflags-$(CONFIG_M5272)		:= $(call cc-option,-mcpu=5271,-m5200)
 cflags-$(CONFIG_M5275)		:= $(call cc-option,-mcpu=5275,-m5307)
 cflags-$(CONFIG_M528x)		:= $(call cc-option,-m528x,-m5307)
 cflags-$(CONFIG_M5307)		:= $(call cc-option,-m5307,-m5200)
diff --git a/trunk/arch/m68knommu/kernel/entry.S b/trunk/arch/m68knommu/kernel/entry.S
index aff6f57ef8b5..56043ade3941 100644
--- a/trunk/arch/m68knommu/kernel/entry.S
+++ b/trunk/arch/m68knommu/kernel/entry.S
@@ -145,6 +145,6 @@ ENTRY(ret_from_user_signal)
 	trap #0
 
 ENTRY(ret_from_user_rt_signal)
-	movel #__NR_rt_sigreturn,%d0
+	move #__NR_rt_sigreturn,%d0
 	trap #0
 
diff --git a/trunk/arch/m68knommu/platform/68360/ints.c b/trunk/arch/m68knommu/platform/68360/ints.c
index 6f22970d8c20..1143f77caca4 100644
--- a/trunk/arch/m68knommu/platform/68360/ints.c
+++ b/trunk/arch/m68knommu/platform/68360/ints.c
@@ -107,6 +107,7 @@ void init_IRQ(void)
 	_ramvec[vba+CPMVEC_PIO_PC7]     = inthandler;  /* pio - pc7 */
 	_ramvec[vba+CPMVEC_PIO_PC6]     = inthandler;  /* pio - pc6 */
 	_ramvec[vba+CPMVEC_TIMER3]      = inthandler;  /* timer 3 */
+	_ramvec[vba+CPMVEC_RISCTIMER]   = inthandler;  /* reserved */
 	_ramvec[vba+CPMVEC_PIO_PC5]     = inthandler;  /* pio - pc5 */
 	_ramvec[vba+CPMVEC_PIO_PC4]     = inthandler;  /* pio - pc4 */
 	_ramvec[vba+CPMVEC_RESERVED2]   = inthandler;  /* reserved */
diff --git a/trunk/arch/powerpc/kvm/book3s.c b/trunk/arch/powerpc/kvm/book3s.c
index 604af29b71ed..25da07fd9f77 100644
--- a/trunk/arch/powerpc/kvm/book3s.c
+++ b/trunk/arch/powerpc/kvm/book3s.c
@@ -1004,8 +1004,7 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
 	struct kvm_vcpu *vcpu;
 	ulong ga, ga_end;
 	int is_dirty = 0;
-	int r;
-	unsigned long n;
+	int r, n;
 
 	mutex_lock(&kvm->slots_lock);
 
@@ -1023,7 +1022,7 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
 		kvm_for_each_vcpu(n, vcpu, kvm)
 			kvmppc_mmu_pte_pflush(vcpu, ga, ga_end);
 
-		n = kvm_dirty_bitmap_bytes(memslot);
+		n = ALIGN(memslot->npages, BITS_PER_LONG) / 8;
 		memset(memslot->dirty_bitmap, 0, n);
 	}
 
diff --git a/trunk/arch/sparc/include/asm/thread_info_64.h b/trunk/arch/sparc/include/asm/thread_info_64.h
index 4827a3aeac7f..9e2d9447f2ad 100644
--- a/trunk/arch/sparc/include/asm/thread_info_64.h
+++ b/trunk/arch/sparc/include/asm/thread_info_64.h
@@ -111,7 +111,7 @@ struct thread_info {
 #define THREAD_SHIFT PAGE_SHIFT
 #endif /* PAGE_SHIFT == 13 */
 
-#define PREEMPT_ACTIVE		0x10000000
+#define PREEMPT_ACTIVE		0x4000000
 
 /*
  * macros/functions for gaining access to the thread information structure
diff --git a/trunk/arch/sparc/kernel/irq_64.c b/trunk/arch/sparc/kernel/irq_64.c
index 830d70a3e20b..454ce3a25273 100644
--- a/trunk/arch/sparc/kernel/irq_64.c
+++ b/trunk/arch/sparc/kernel/irq_64.c
@@ -22,7 +22,6 @@
 #include <linux/seq_file.h>
 #include <linux/ftrace.h>
 #include <linux/irq.h>
-#include <linux/kmemleak.h>
 
 #include <asm/ptrace.h>
 #include <asm/processor.h>
@@ -47,7 +46,6 @@
 
 #include "entry.h"
 #include "cpumap.h"
-#include "kstack.h"
 
 #define NUM_IVECS	(IMAP_INR + 1)
 
@@ -714,6 +712,24 @@ void ack_bad_irq(unsigned int virt_irq)
 void *hardirq_stack[NR_CPUS];
 void *softirq_stack[NR_CPUS];
 
+static __attribute__((always_inline)) void *set_hardirq_stack(void)
+{
+	void *orig_sp, *sp = hardirq_stack[smp_processor_id()];
+
+	__asm__ __volatile__("mov %%sp, %0" : "=r" (orig_sp));
+	if (orig_sp < sp ||
+	    orig_sp > (sp + THREAD_SIZE)) {
+		sp += THREAD_SIZE - 192 - STACK_BIAS;
+		__asm__ __volatile__("mov %0, %%sp" : : "r" (sp));
+	}
+
+	return orig_sp;
+}
+static __attribute__((always_inline)) void restore_hardirq_stack(void *orig_sp)
+{
+	__asm__ __volatile__("mov %0, %%sp" : : "r" (orig_sp));
+}
+
 void __irq_entry handler_irq(int irq, struct pt_regs *regs)
 {
 	unsigned long pstate, bucket_pa;
diff --git a/trunk/arch/sparc/kernel/kstack.h b/trunk/arch/sparc/kernel/kstack.h
index 53dfb92e09fb..5247283d1c03 100644
--- a/trunk/arch/sparc/kernel/kstack.h
+++ b/trunk/arch/sparc/kernel/kstack.h
@@ -61,23 +61,4 @@ static inline bool kstack_is_trap_frame(struct thread_info *tp, struct pt_regs *
 
 }
 
-static inline __attribute__((always_inline)) void *set_hardirq_stack(void)
-{
-	void *orig_sp, *sp = hardirq_stack[smp_processor_id()];
-
-	__asm__ __volatile__("mov %%sp, %0" : "=r" (orig_sp));
-	if (orig_sp < sp ||
-	    orig_sp > (sp + THREAD_SIZE)) {
-		sp += THREAD_SIZE - 192 - STACK_BIAS;
-		__asm__ __volatile__("mov %0, %%sp" : : "r" (sp));
-	}
-
-	return orig_sp;
-}
-
-static inline __attribute__((always_inline)) void restore_hardirq_stack(void *orig_sp)
-{
-	__asm__ __volatile__("mov %0, %%sp" : : "r" (orig_sp));
-}
-
 #endif /* _KSTACK_H */
diff --git a/trunk/arch/sparc/kernel/nmi.c b/trunk/arch/sparc/kernel/nmi.c
index a4bd7ba74c89..75a3d1a25356 100644
--- a/trunk/arch/sparc/kernel/nmi.c
+++ b/trunk/arch/sparc/kernel/nmi.c
@@ -23,8 +23,6 @@
 #include <asm/ptrace.h>
 #include <asm/pcr.h>
 
-#include "kstack.h"
-
 /* We don't have a real NMI on sparc64, but we can fake one
  * up using profiling counter overflow interrupts and interrupt
  * levels.
@@ -94,7 +92,6 @@ static void die_nmi(const char *str, struct pt_regs *regs, int do_panic)
 notrace __kprobes void perfctr_irq(int irq, struct pt_regs *regs)
 {
 	unsigned int sum, touched = 0;
-	void *orig_sp;
 
 	clear_softint(1 << irq);
 
@@ -102,8 +99,6 @@ notrace __kprobes void perfctr_irq(int irq, struct pt_regs *regs)
 
 	nmi_enter();
 
-	orig_sp = set_hardirq_stack();
-
 	if (notify_die(DIE_NMI, "nmi", regs, 0,
 		       pt_regs_trap_type(regs), SIGINT) == NOTIFY_STOP)
 		touched = 1;
@@ -129,8 +124,6 @@ notrace __kprobes void perfctr_irq(int irq, struct pt_regs *regs)
 		pcr_ops->write(pcr_enable);
 	}
 
-	restore_hardirq_stack(orig_sp);
-
 	nmi_exit();
 }
 
diff --git a/trunk/arch/sparc/kernel/rtrap_64.S b/trunk/arch/sparc/kernel/rtrap_64.S
index 090b9e9ad5e3..83f1873c6c13 100644
--- a/trunk/arch/sparc/kernel/rtrap_64.S
+++ b/trunk/arch/sparc/kernel/rtrap_64.S
@@ -130,17 +130,7 @@ rtrap_xcall:
 		 nop
 		call			trace_hardirqs_on
 		 nop
-		/* Do not actually set the %pil here.  We will do that
-		 * below after we clear PSTATE_IE in the %pstate register.
-		 * If we re-enable interrupts here, we can recurse down
-		 * the hardirq stack potentially endlessly, causing a
-		 * stack overflow.
-		 *
-		 * It is tempting to put this test and trace_hardirqs_on
-		 * call at the 'rt_continue' label, but that will not work
-		 * as that path hits unconditionally and we do not want to
-		 * execute this in NMI return paths, for example.
-		 */
+		wrpr			%l4, %pil
 #endif
 rtrap_no_irq_enable:
 		andcc			%l1, TSTATE_PRIV, %l3
diff --git a/trunk/arch/sparc/kernel/unaligned_64.c b/trunk/arch/sparc/kernel/unaligned_64.c
index c752c4c479bd..ebce43018c49 100644
--- a/trunk/arch/sparc/kernel/unaligned_64.c
+++ b/trunk/arch/sparc/kernel/unaligned_64.c
@@ -50,7 +50,7 @@ static inline enum direction decode_direction(unsigned int insn)
 }
 
 /* 16 = double-word, 8 = extra-word, 4 = word, 2 = half-word */
-static inline int decode_access_size(struct pt_regs *regs, unsigned int insn)
+static inline int decode_access_size(unsigned int insn)
 {
 	unsigned int tmp;
 
@@ -66,7 +66,7 @@ static inline int decode_access_size(struct pt_regs *regs, unsigned int insn)
 		return 2;
 	else {
 		printk("Impossible unaligned trap. insn=%08x\n", insn);
-		die_if_kernel("Byte sized unaligned access?!?!", regs);
+		die_if_kernel("Byte sized unaligned access?!?!", current_thread_info()->kregs);
 
 		/* GCC should never warn that control reaches the end
 		 * of this function without returning a value because
@@ -286,7 +286,7 @@ static void log_unaligned(struct pt_regs *regs)
 asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn)
 {
 	enum direction dir = decode_direction(insn);
-	int size = decode_access_size(regs, insn);
+	int size = decode_access_size(insn);
 	int orig_asi, asi;
 
 	current_thread_info()->kern_una_regs = regs;
diff --git a/trunk/arch/sparc/lib/mcount.S b/trunk/arch/sparc/lib/mcount.S
index 3ad6cbdc2163..3753e3c6e176 100644
--- a/trunk/arch/sparc/lib/mcount.S
+++ b/trunk/arch/sparc/lib/mcount.S
@@ -34,7 +34,7 @@ mcount:
 	cmp		%g1, %g2
 	be,pn		%icc, 1f
 	 mov		%i7, %g3
-	save		%sp, -176, %sp
+	save		%sp, -128, %sp
 	mov		%g3, %o1
 	jmpl		%g1, %o7
 	 mov		%i7, %o0
@@ -56,7 +56,7 @@ mcount:
 	 nop
 5:	mov		%i7, %g2
 	mov		%fp, %g3
-	save		%sp, -176, %sp
+	save		%sp, -128, %sp
 	mov		%g2, %l0
 	ba,pt		%xcc, ftrace_graph_caller
 	 mov		%g3, %l1
@@ -85,7 +85,7 @@ ftrace_caller:
 	lduw		[%g1 + %lo(function_trace_stop)], %g1
 	brnz,pn		%g1, ftrace_stub
 	 mov		%fp, %g3
-	save		%sp, -176, %sp
+	save		%sp, -128, %sp
 	mov		%g2, %o1
 	mov		%g2, %l0
 	mov		%g3, %l1
@@ -120,7 +120,7 @@ ENTRY(ftrace_graph_caller)
 END(ftrace_graph_caller)
 
 ENTRY(return_to_handler)
-	save		%sp, -176, %sp
+	save		%sp, -128, %sp
 	call		ftrace_return_to_handler
 	 mov		%fp, %o0
 	jmpl		%o0 + 8, %g0
diff --git a/trunk/arch/x86/ia32/ia32entry.S b/trunk/arch/x86/ia32/ia32entry.S
index e790bc1fbfa3..59b4556a5b92 100644
--- a/trunk/arch/x86/ia32/ia32entry.S
+++ b/trunk/arch/x86/ia32/ia32entry.S
@@ -626,7 +626,7 @@ ia32_sys_call_table:
 	.quad stub32_sigreturn
 	.quad stub32_clone		/* 120 */
 	.quad sys_setdomainname
-	.quad sys_newuname
+	.quad sys_uname
 	.quad sys_modify_ldt
 	.quad compat_sys_adjtimex
 	.quad sys32_mprotect		/* 125 */
diff --git a/trunk/arch/x86/kernel/dumpstack.h b/trunk/arch/x86/kernel/dumpstack.h
index e1a93be4fd44..e39e77168a37 100644
--- a/trunk/arch/x86/kernel/dumpstack.h
+++ b/trunk/arch/x86/kernel/dumpstack.h
@@ -14,8 +14,6 @@
 #define get_bp(bp) asm("movq %%rbp, %0" : "=r" (bp) :)
 #endif
 
-#include <linux/uaccess.h>
-
 extern void
 show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
 		unsigned long *stack, unsigned long bp, char *log_lvl);
@@ -44,10 +42,8 @@ static inline unsigned long rewind_frame_pointer(int n)
 	get_bp(frame);
 
 #ifdef CONFIG_FRAME_POINTER
-	while (n--) {
-		if (probe_kernel_address(&frame->next_frame, frame))
-			break;
-	}
+	while (n--)
+		frame = frame->next_frame;
 #endif
 
 	return (unsigned long)frame;
diff --git a/trunk/arch/x86/kvm/mmu.c b/trunk/arch/x86/kvm/mmu.c
index 19a8906bcaa2..48aeee8eefb0 100644
--- a/trunk/arch/x86/kvm/mmu.c
+++ b/trunk/arch/x86/kvm/mmu.c
@@ -1490,8 +1490,8 @@ static int mmu_zap_unsync_children(struct kvm *kvm,
 		for_each_sp(pages, sp, parents, i) {
 			kvm_mmu_zap_page(kvm, sp);
 			mmu_pages_clear_parents(&parents);
-			zapped++;
 		}
+		zapped += pages.nr;
 		kvm_mmu_pages_init(parent, &parents, &pages);
 	}
 
@@ -1542,16 +1542,14 @@ void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages)
 	 */
 
 	if (used_pages > kvm_nr_mmu_pages) {
-		while (used_pages > kvm_nr_mmu_pages &&
-			!list_empty(&kvm->arch.active_mmu_pages)) {
+		while (used_pages > kvm_nr_mmu_pages) {
 			struct kvm_mmu_page *page;
 
 			page = container_of(kvm->arch.active_mmu_pages.prev,
 					    struct kvm_mmu_page, link);
-			used_pages -= kvm_mmu_zap_page(kvm, page);
+			kvm_mmu_zap_page(kvm, page);
 			used_pages--;
 		}
-		kvm_nr_mmu_pages = used_pages;
 		kvm->arch.n_free_mmu_pages = 0;
 	}
 	else
@@ -1598,8 +1596,7 @@ static void mmu_unshadow(struct kvm *kvm, gfn_t gfn)
 		    && !sp->role.invalid) {
 			pgprintk("%s: zap %lx %x\n",
 				 __func__, gfn, sp->role.word);
-			if (kvm_mmu_zap_page(kvm, sp))
-				nn = bucket->first;
+			kvm_mmu_zap_page(kvm, sp);
 		}
 	}
 }
diff --git a/trunk/arch/x86/kvm/svm.c b/trunk/arch/x86/kvm/svm.c
index 2ba58206812a..445c59411ed0 100644
--- a/trunk/arch/x86/kvm/svm.c
+++ b/trunk/arch/x86/kvm/svm.c
@@ -706,28 +706,29 @@ static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
 	if (err)
 		goto free_svm;
 
-	err = -ENOMEM;
 	page = alloc_page(GFP_KERNEL);
-	if (!page)
+	if (!page) {
+		err = -ENOMEM;
 		goto uninit;
+	}
 
+	err = -ENOMEM;
 	msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
 	if (!msrpm_pages)
-		goto free_page1;
+		goto uninit;
 
 	nested_msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
 	if (!nested_msrpm_pages)
-		goto free_page2;
+		goto uninit;
+
+	svm->msrpm = page_address(msrpm_pages);
+	svm_vcpu_init_msrpm(svm->msrpm);
 
 	hsave_page = alloc_page(GFP_KERNEL);
 	if (!hsave_page)
-		goto free_page3;
-
+		goto uninit;
 	svm->nested.hsave = page_address(hsave_page);
 
-	svm->msrpm = page_address(msrpm_pages);
-	svm_vcpu_init_msrpm(svm->msrpm);
-
 	svm->nested.msrpm = page_address(nested_msrpm_pages);
 
 	svm->vmcb = page_address(page);
@@ -743,12 +744,6 @@ static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
 
 	return &svm->vcpu;
 
-free_page3:
-	__free_pages(nested_msrpm_pages, MSRPM_ALLOC_ORDER);
-free_page2:
-	__free_pages(msrpm_pages, MSRPM_ALLOC_ORDER);
-free_page1:
-	__free_page(page);
 uninit:
 	kvm_vcpu_uninit(&svm->vcpu);
 free_svm:
diff --git a/trunk/arch/x86/kvm/vmx.c b/trunk/arch/x86/kvm/vmx.c
index bc933cfb4e66..686492ed3079 100644
--- a/trunk/arch/x86/kvm/vmx.c
+++ b/trunk/arch/x86/kvm/vmx.c
@@ -77,8 +77,6 @@ module_param(emulate_invalid_guest_state, bool, S_IRUGO);
 #define KVM_PMODE_VM_CR4_ALWAYS_ON (X86_CR4_PAE | X86_CR4_VMXE)
 #define KVM_RMODE_VM_CR4_ALWAYS_ON (X86_CR4_VME | X86_CR4_PAE | X86_CR4_VMXE)
 
-#define RMODE_GUEST_OWNED_EFLAGS_BITS (~(X86_EFLAGS_IOPL | X86_EFLAGS_VM))
-
 /*
  * These 2 parameters are used to config the controls for Pause-Loop Exiting:
  * ple_gap:    upper bound on the amount of time between two successive
@@ -133,7 +131,7 @@ struct vcpu_vmx {
 	} host_state;
 	struct {
 		int vm86_active;
-		ulong save_rflags;
+		u8 save_iopl;
 		struct kvm_save_segment {
 			u16 selector;
 			unsigned long base;
@@ -820,23 +818,18 @@ static void vmx_fpu_deactivate(struct kvm_vcpu *vcpu)
 
 static unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu)
 {
-	unsigned long rflags, save_rflags;
+	unsigned long rflags;
 
 	rflags = vmcs_readl(GUEST_RFLAGS);
-	if (to_vmx(vcpu)->rmode.vm86_active) {
-		rflags &= RMODE_GUEST_OWNED_EFLAGS_BITS;
-		save_rflags = to_vmx(vcpu)->rmode.save_rflags;
-		rflags |= save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS;
-	}
+	if (to_vmx(vcpu)->rmode.vm86_active)
+		rflags &= ~(unsigned long)(X86_EFLAGS_IOPL | X86_EFLAGS_VM);
 	return rflags;
 }
 
 static void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
 {
-	if (to_vmx(vcpu)->rmode.vm86_active) {
-		to_vmx(vcpu)->rmode.save_rflags = rflags;
+	if (to_vmx(vcpu)->rmode.vm86_active)
 		rflags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM;
-	}
 	vmcs_writel(GUEST_RFLAGS, rflags);
 }
 
@@ -1490,8 +1483,8 @@ static void enter_pmode(struct kvm_vcpu *vcpu)
 	vmcs_write32(GUEST_TR_AR_BYTES, vmx->rmode.tr.ar);
 
 	flags = vmcs_readl(GUEST_RFLAGS);
-	flags &= RMODE_GUEST_OWNED_EFLAGS_BITS;
-	flags |= vmx->rmode.save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS;
+	flags &= ~(X86_EFLAGS_IOPL | X86_EFLAGS_VM);
+	flags |= (vmx->rmode.save_iopl << IOPL_SHIFT);
 	vmcs_writel(GUEST_RFLAGS, flags);
 
 	vmcs_writel(GUEST_CR4, (vmcs_readl(GUEST_CR4) & ~X86_CR4_VME) |
@@ -1564,7 +1557,8 @@ static void enter_rmode(struct kvm_vcpu *vcpu)
 	vmcs_write32(GUEST_TR_AR_BYTES, 0x008b);
 
 	flags = vmcs_readl(GUEST_RFLAGS);
-	vmx->rmode.save_rflags = flags;
+	vmx->rmode.save_iopl
+		= (flags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
 
 	flags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM;
 
diff --git a/trunk/arch/x86/kvm/x86.c b/trunk/arch/x86/kvm/x86.c
index 3c4ca98ad27f..24cd0ee896e9 100644
--- a/trunk/arch/x86/kvm/x86.c
+++ b/trunk/arch/x86/kvm/x86.c
@@ -433,6 +433,8 @@ void kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
 
 #ifdef CONFIG_X86_64
 	if (cr0 & 0xffffffff00000000UL) {
+		printk(KERN_DEBUG "set_cr0: 0x%lx #GP, reserved bits 0x%lx\n",
+		       cr0, kvm_read_cr0(vcpu));
 		kvm_inject_gp(vcpu, 0);
 		return;
 	}
@@ -441,11 +443,14 @@ void kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
 	cr0 &= ~CR0_RESERVED_BITS;
 
 	if ((cr0 & X86_CR0_NW) && !(cr0 & X86_CR0_CD)) {
+		printk(KERN_DEBUG "set_cr0: #GP, CD == 0 && NW == 1\n");
 		kvm_inject_gp(vcpu, 0);
 		return;
 	}
 
 	if ((cr0 & X86_CR0_PG) && !(cr0 & X86_CR0_PE)) {
+		printk(KERN_DEBUG "set_cr0: #GP, set PG flag "
+		       "and a clear PE flag\n");
 		kvm_inject_gp(vcpu, 0);
 		return;
 	}
@@ -456,11 +461,15 @@ void kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
 			int cs_db, cs_l;
 
 			if (!is_pae(vcpu)) {
+				printk(KERN_DEBUG "set_cr0: #GP, start paging "
+				       "in long mode while PAE is disabled\n");
 				kvm_inject_gp(vcpu, 0);
 				return;
 			}
 			kvm_x86_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l);
 			if (cs_l) {
+				printk(KERN_DEBUG "set_cr0: #GP, start paging "
+				       "in long mode while CS.L == 1\n");
 				kvm_inject_gp(vcpu, 0);
 				return;
 
@@ -468,6 +477,8 @@ void kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
 		} else
 #endif
 		if (is_pae(vcpu) && !load_pdptrs(vcpu, vcpu->arch.cr3)) {
+			printk(KERN_DEBUG "set_cr0: #GP, pdptrs "
+			       "reserved bits\n");
 			kvm_inject_gp(vcpu, 0);
 			return;
 		}
@@ -494,23 +505,28 @@ void kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 	unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE;
 
 	if (cr4 & CR4_RESERVED_BITS) {
+		printk(KERN_DEBUG "set_cr4: #GP, reserved bits\n");
 		kvm_inject_gp(vcpu, 0);
 		return;
 	}
 
 	if (is_long_mode(vcpu)) {
 		if (!(cr4 & X86_CR4_PAE)) {
+			printk(KERN_DEBUG "set_cr4: #GP, clearing PAE while "
+			       "in long mode\n");
 			kvm_inject_gp(vcpu, 0);
 			return;
 		}
 	} else if (is_paging(vcpu) && (cr4 & X86_CR4_PAE)
 		   && ((cr4 ^ old_cr4) & pdptr_bits)
 		   && !load_pdptrs(vcpu, vcpu->arch.cr3)) {
+		printk(KERN_DEBUG "set_cr4: #GP, pdptrs reserved bits\n");
 		kvm_inject_gp(vcpu, 0);
 		return;
 	}
 
 	if (cr4 & X86_CR4_VMXE) {
+		printk(KERN_DEBUG "set_cr4: #GP, setting VMXE\n");
 		kvm_inject_gp(vcpu, 0);
 		return;
 	}
@@ -531,16 +547,21 @@ void kvm_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
 
 	if (is_long_mode(vcpu)) {
 		if (cr3 & CR3_L_MODE_RESERVED_BITS) {
+			printk(KERN_DEBUG "set_cr3: #GP, reserved bits\n");
 			kvm_inject_gp(vcpu, 0);
 			return;
 		}
 	} else {
 		if (is_pae(vcpu)) {
 			if (cr3 & CR3_PAE_RESERVED_BITS) {
+				printk(KERN_DEBUG
+				       "set_cr3: #GP, reserved bits\n");
 				kvm_inject_gp(vcpu, 0);
 				return;
 			}
 			if (is_paging(vcpu) && !load_pdptrs(vcpu, cr3)) {
+				printk(KERN_DEBUG "set_cr3: #GP, pdptrs "
+				       "reserved bits\n");
 				kvm_inject_gp(vcpu, 0);
 				return;
 			}
@@ -572,6 +593,7 @@ EXPORT_SYMBOL_GPL(kvm_set_cr3);
 void kvm_set_cr8(struct kvm_vcpu *vcpu, unsigned long cr8)
 {
 	if (cr8 & CR8_RESERVED_BITS) {
+		printk(KERN_DEBUG "set_cr8: #GP, reserved bits 0x%lx\n", cr8);
 		kvm_inject_gp(vcpu, 0);
 		return;
 	}
@@ -627,12 +649,15 @@ static u32 emulated_msrs[] = {
 static void set_efer(struct kvm_vcpu *vcpu, u64 efer)
 {
 	if (efer & efer_reserved_bits) {
+		printk(KERN_DEBUG "set_efer: 0x%llx #GP, reserved bits\n",
+		       efer);
 		kvm_inject_gp(vcpu, 0);
 		return;
 	}
 
 	if (is_paging(vcpu)
 	    && (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME)) {
+		printk(KERN_DEBUG "set_efer: #GP, change LME while paging\n");
 		kvm_inject_gp(vcpu, 0);
 		return;
 	}
@@ -642,6 +667,7 @@ static void set_efer(struct kvm_vcpu *vcpu, u64 efer)
 
 		feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0);
 		if (!feat || !(feat->edx & bit(X86_FEATURE_FXSR_OPT))) {
+			printk(KERN_DEBUG "set_efer: #GP, enable FFXSR w/o CPUID capability\n");
 			kvm_inject_gp(vcpu, 0);
 			return;
 		}
@@ -652,6 +678,7 @@ static void set_efer(struct kvm_vcpu *vcpu, u64 efer)
 
 		feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0);
 		if (!feat || !(feat->ecx & bit(X86_FEATURE_SVM))) {
+			printk(KERN_DEBUG "set_efer: #GP, enable SVM w/o SVM\n");
 			kvm_inject_gp(vcpu, 0);
 			return;
 		}
@@ -940,13 +967,9 @@ static int set_msr_mce(struct kvm_vcpu *vcpu, u32 msr, u64 data)
 		if (msr >= MSR_IA32_MC0_CTL &&
 		    msr < MSR_IA32_MC0_CTL + 4 * bank_num) {
 			u32 offset = msr - MSR_IA32_MC0_CTL;
-			/* only 0 or all 1s can be written to IA32_MCi_CTL
-			 * some Linux kernels though clear bit 10 in bank 4 to
-			 * workaround a BIOS/GART TBL issue on AMD K8s, ignore
-			 * this to avoid an uncatched #GP in the guest
-			 */
+			/* only 0 or all 1s can be written to IA32_MCi_CTL */
 			if ((offset & 0x3) == 0 &&
-			    data != 0 && (data | (1 << 10)) != ~(u64)0)
+			    data != 0 && data != ~(u64)0)
 				return -1;
 			vcpu->arch.mce_banks[offset] = data;
 			break;
@@ -2612,9 +2635,8 @@ static int kvm_vm_ioctl_reinject(struct kvm *kvm,
 int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
 				      struct kvm_dirty_log *log)
 {
-	int r, i;
+	int r, n, i;
 	struct kvm_memory_slot *memslot;
-	unsigned long n;
 	unsigned long is_dirty = 0;
 	unsigned long *dirty_bitmap = NULL;
 
@@ -2629,7 +2651,7 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
 	if (!memslot->dirty_bitmap)
 		goto out;
 
-	n = kvm_dirty_bitmap_bytes(memslot);
+	n = ALIGN(memslot->npages, BITS_PER_LONG) / 8;
 
 	r = -ENOMEM;
 	dirty_bitmap = vmalloc(n);
@@ -4461,9 +4483,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 		kvm_set_cr8(vcpu, kvm_run->cr8);
 
 	if (vcpu->arch.pio.cur_count) {
-		vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
 		r = complete_pio(vcpu);
-		srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
 		if (r)
 			goto out;
 	}
@@ -5126,7 +5146,6 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason)
 	int ret = 0;
 	u32 old_tss_base = get_segment_base(vcpu, VCPU_SREG_TR);
 	u16 old_tss_sel = get_segment_selector(vcpu, VCPU_SREG_TR);
-	u32 desc_limit;
 
 	old_tss_base = kvm_mmu_gva_to_gpa_write(vcpu, old_tss_base, NULL);
 
@@ -5149,10 +5168,7 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason)
 		}
 	}
 
-	desc_limit = get_desc_limit(&nseg_desc);
-	if (!nseg_desc.p ||
-	    ((desc_limit < 0x67 && (nseg_desc.type & 8)) ||
-	     desc_limit < 0x2b)) {
+	if (!nseg_desc.p || get_desc_limit(&nseg_desc) < 0x67) {
 		kvm_queue_exception_e(vcpu, TS_VECTOR, tss_selector & 0xfffc);
 		return 1;
 	}
diff --git a/trunk/drivers/char/pcmcia/cm4000_cs.c b/trunk/drivers/char/pcmcia/cm4000_cs.c
index 90b199f97bec..c9bc896d68af 100644
--- a/trunk/drivers/char/pcmcia/cm4000_cs.c
+++ b/trunk/drivers/char/pcmcia/cm4000_cs.c
@@ -1026,16 +1026,14 @@ static ssize_t cmm_read(struct file *filp, __user char *buf, size_t count,
 
 	xoutb(0, REG_FLAGS1(iobase));	/* clear detectCMM */
 	/* last check before exit */
-	if (!io_detect_cm4000(iobase, dev)) {
-		rc = -ENODEV;
-		goto release_io;
-	}
+	if (!io_detect_cm4000(iobase, dev))
+		count = -ENODEV;
 
 	if (test_bit(IS_INVREV, &dev->flags) && count > 0)
 		str_invert_revert(dev->rbuf, count);
 
 	if (copy_to_user(buf, dev->rbuf, count))
-		rc = -EFAULT;
+		return -EFAULT;
 
 release_io:
 	clear_bit(LOCK_IO, &dev->flags);
diff --git a/trunk/drivers/gpu/drm/drm_stub.c b/trunk/drivers/gpu/drm/drm_stub.c
index a0c365f2e521..b743411d8144 100644
--- a/trunk/drivers/gpu/drm/drm_stub.c
+++ b/trunk/drivers/gpu/drm/drm_stub.c
@@ -516,6 +516,8 @@ void drm_put_dev(struct drm_device *dev)
 	}
 	driver = dev->driver;
 
+	drm_vblank_cleanup(dev);
+
 	drm_lastclose(dev);
 
 	if (drm_core_has_MTRR(dev) && drm_core_has_AGP(dev) &&
@@ -535,8 +537,6 @@ void drm_put_dev(struct drm_device *dev)
 		dev->agp = NULL;
 	}
 
-	drm_vblank_cleanup(dev);
-
 	list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head)
 		drm_rmmap(dev, r_list->map);
 	drm_ht_remove(&dev->map_hash);
diff --git a/trunk/drivers/i2c/busses/i2c-imx.c b/trunk/drivers/i2c/busses/i2c-imx.c
index f7e27b702375..d1ff9408dc1f 100644
--- a/trunk/drivers/i2c/busses/i2c-imx.c
+++ b/trunk/drivers/i2c/busses/i2c-imx.c
@@ -146,10 +146,10 @@ static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy)
 				"<%s> I2C Interrupted\n", __func__);
 			return -EINTR;
 		}
-		if (time_after(jiffies, orig_jiffies + HZ / 1000)) {
+		if (time_after(jiffies, orig_jiffies + msecs_to_jiffies(500))) {
 			dev_dbg(&i2c_imx->adapter.dev,
 				"<%s> I2C bus is busy\n", __func__);
-			return -EIO;
+			return -ETIMEDOUT;
 		}
 		schedule();
 	}
@@ -444,6 +444,8 @@ static int i2c_imx_xfer(struct i2c_adapter *adapter,
 			result = i2c_imx_read(i2c_imx, &msgs[i]);
 		else
 			result = i2c_imx_write(i2c_imx, &msgs[i]);
+		if (result)
+			goto fail0;
 	}
 
 fail0:
diff --git a/trunk/drivers/md/raid5.c b/trunk/drivers/md/raid5.c
index 20e48401910e..e3e9a36ea3b7 100644
--- a/trunk/drivers/md/raid5.c
+++ b/trunk/drivers/md/raid5.c
@@ -1650,8 +1650,8 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
 				     int previous, int *dd_idx,
 				     struct stripe_head *sh)
 {
-	sector_t stripe;
-	sector_t chunk_number;
+	long stripe;
+	unsigned long chunk_number;
 	unsigned int chunk_offset;
 	int pd_idx, qd_idx;
 	int ddf_layout = 0;
@@ -1671,12 +1671,17 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
 	 */
 	chunk_offset = sector_div(r_sector, sectors_per_chunk);
 	chunk_number = r_sector;
+	BUG_ON(r_sector != chunk_number);
 
 	/*
 	 * Compute the stripe number
 	 */
-	stripe = chunk_number;
-	*dd_idx = sector_div(stripe, data_disks);
+	stripe = chunk_number / data_disks;
+
+	/*
+	 * Compute the data disk and parity disk indexes inside the stripe
+	 */
+	*dd_idx = chunk_number % data_disks;
 
 	/*
 	 * Select the parity disk based on the user selected algorithm.
@@ -1865,14 +1870,14 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
 				 : conf->algorithm;
 	sector_t stripe;
 	int chunk_offset;
-	sector_t chunk_number;
-	int dummy1, dd_idx = i;
+	int chunk_number, dummy1, dd_idx = i;
 	sector_t r_sector;
 	struct stripe_head sh2;
 
 
 	chunk_offset = sector_div(new_sector, sectors_per_chunk);
 	stripe = new_sector;
+	BUG_ON(new_sector != stripe);
 
 	if (i == sh->pd_idx)
 		return 0;
@@ -1965,7 +1970,7 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
 	}
 
 	chunk_number = stripe * data_disks + i;
-	r_sector = chunk_number * sectors_per_chunk + chunk_offset;
+	r_sector = (sector_t)chunk_number * sectors_per_chunk + chunk_offset;
 
 	check = raid5_compute_sector(conf, r_sector,
 				     previous, &dummy1, &sh2);
diff --git a/trunk/drivers/pcmcia/cistpl.c b/trunk/drivers/pcmcia/cistpl.c
index 854959cada3a..f230f6543bff 100644
--- a/trunk/drivers/pcmcia/cistpl.c
+++ b/trunk/drivers/pcmcia/cistpl.c
@@ -1484,11 +1484,6 @@ int pccard_validate_cis(struct pcmcia_socket *s, unsigned int *info)
 	if (!s)
 		return -EINVAL;
 
-	if (s->functions) {
-		WARN_ON(1);
-		return -EINVAL;
-	}
-
 	/* We do not want to validate the CIS cache... */
 	mutex_lock(&s->ops_mutex);
 	destroy_cis_cache(s);
@@ -1644,7 +1639,7 @@ static ssize_t pccard_show_cis(struct kobject *kobj,
 		count = 0;
 	else {
 		struct pcmcia_socket *s;
-		unsigned int chains = 1;
+		unsigned int chains;
 
 		if (off + count > size)
 			count = size - off;
@@ -1653,7 +1648,7 @@ static ssize_t pccard_show_cis(struct kobject *kobj,
 
 		if (!(s->state & SOCKET_PRESENT))
 			return -ENODEV;
-		if (!s->functions && pccard_validate_cis(s, &chains))
+		if (pccard_validate_cis(s, &chains))
 			return -EIO;
 		if (!chains)
 			return -ENODATA;
diff --git a/trunk/drivers/pcmcia/db1xxx_ss.c b/trunk/drivers/pcmcia/db1xxx_ss.c
index 2d48196a48cd..6206408e196c 100644
--- a/trunk/drivers/pcmcia/db1xxx_ss.c
+++ b/trunk/drivers/pcmcia/db1xxx_ss.c
@@ -166,10 +166,8 @@ static int db1x_pcmcia_setup_irqs(struct db1x_pcmcia_sock *sock)
 
 		ret = request_irq(sock->insert_irq, db1200_pcmcia_cdirq,
 				  IRQF_DISABLED, "pcmcia_insert", sock);
-		if (ret) {
-			local_irq_restore(flags);
+		if (ret)
 			goto out1;
-		}
 
 		ret = request_irq(sock->eject_irq, db1200_pcmcia_cdirq,
 				  IRQF_DISABLED, "pcmcia_eject", sock);
diff --git a/trunk/drivers/pcmcia/ds.c b/trunk/drivers/pcmcia/ds.c
index 4014cf8e4a26..cb6036d89e59 100644
--- a/trunk/drivers/pcmcia/ds.c
+++ b/trunk/drivers/pcmcia/ds.c
@@ -687,10 +687,12 @@ static void pcmcia_requery(struct pcmcia_socket *s)
 			new_funcs = mfc.nfn;
 		else
 			new_funcs = 1;
-		if (old_funcs != new_funcs) {
-			/* we need to re-start */
+		if (old_funcs > new_funcs) {
 			pcmcia_card_remove(s, NULL);
 			pcmcia_card_add(s);
+		} else if (new_funcs > old_funcs) {
+			s->functions = new_funcs;
+			pcmcia_device_add(s, 1);
 		}
 	}
 
@@ -726,8 +728,6 @@ static int pcmcia_load_firmware(struct pcmcia_device *dev, char * filename)
 	struct pcmcia_socket *s = dev->socket;
 	const struct firmware *fw;
 	int ret = -ENOMEM;
-	cistpl_longlink_mfc_t mfc;
-	int old_funcs, new_funcs = 1;
 
 	if (!filename)
 		return -EINVAL;
@@ -750,14 +750,6 @@ static int pcmcia_load_firmware(struct pcmcia_device *dev, char * filename)
 			goto release;
 		}
 
-		/* we need to re-start if the number of functions changed */
-		old_funcs = s->functions;
-		if (!pccard_read_tuple(s, BIND_FN_ALL, CISTPL_LONGLINK_MFC,
-					&mfc))
-			new_funcs = mfc.nfn;
-
-		if (old_funcs != new_funcs)
-			ret = -EBUSY;
 
 		/* update information */
 		pcmcia_device_query(dev);
@@ -866,8 +858,10 @@ static inline int pcmcia_devmatch(struct pcmcia_device *dev,
 	if (did->match_flags & PCMCIA_DEV_ID_MATCH_FAKE_CIS) {
 		dev_dbg(&dev->dev, "device needs a fake CIS\n");
 		if (!dev->socket->fake_cis)
-			if (pcmcia_load_firmware(dev, did->cisfile))
-				return 0;
+			pcmcia_load_firmware(dev, did->cisfile);
+
+		if (!dev->socket->fake_cis)
+			return 0;
 	}
 
 	if (did->match_flags & PCMCIA_DEV_ID_MATCH_ANONYMOUS) {
diff --git a/trunk/drivers/pcmcia/pcmcia_resource.c b/trunk/drivers/pcmcia/pcmcia_resource.c
index 7c3d03bb4f30..caec1dee2a4b 100644
--- a/trunk/drivers/pcmcia/pcmcia_resource.c
+++ b/trunk/drivers/pcmcia/pcmcia_resource.c
@@ -755,12 +755,12 @@ int pcmcia_request_irq(struct pcmcia_device *p_dev, irq_req_t *req)
 	else
 		printk(KERN_WARNING "pcmcia: Driver needs updating to support IRQ sharing.\n");
 
-	/* If the interrupt is already assigned, it must be the same */
-	if (s->irq.AssignedIRQ != 0)
-		irq = s->irq.AssignedIRQ;
-
 #ifdef CONFIG_PCMCIA_PROBE
-	if (!irq) {
+
+	if (s->irq.AssignedIRQ != 0) {
+		/* If the interrupt is already assigned, it must be the same */
+		irq = s->irq.AssignedIRQ;
+	} else {
 		int try;
 		u32 mask = s->irq_mask;
 		void *data = p_dev; /* something unique to this device */
diff --git a/trunk/drivers/pcmcia/rsrc_nonstatic.c b/trunk/drivers/pcmcia/rsrc_nonstatic.c
index a6eb7b59ba9f..559069a80a3b 100644
--- a/trunk/drivers/pcmcia/rsrc_nonstatic.c
+++ b/trunk/drivers/pcmcia/rsrc_nonstatic.c
@@ -214,7 +214,7 @@ static void do_io_probe(struct pcmcia_socket *s, unsigned int base,
 		return;
 	}
 	for (i = base, most = 0; i < base+num; i += 8) {
-		res = claim_region(s, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
+		res = claim_region(NULL, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
 		if (!res)
 			continue;
 		hole = inb(i);
@@ -231,14 +231,9 @@ static void do_io_probe(struct pcmcia_socket *s, unsigned int base,
 
 	bad = any = 0;
 	for (i = base; i < base+num; i += 8) {
-		res = claim_region(s, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
-		if (!res) {
-			if (!any)
-				printk(" excluding");
-			if (!bad)
-				bad = any = i;
+		res = claim_region(NULL, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
+		if (!res)
 			continue;
-		}
 		for (j = 0; j < 8; j++)
 			if (inb(i+j) != most)
 				break;
@@ -258,7 +253,6 @@ static void do_io_probe(struct pcmcia_socket *s, unsigned int base,
 	}
 	if (bad) {
 		if ((num > 16) && (bad == base) && (i == base+num)) {
-			sub_interval(&s_data->io_db, bad, i-bad);
 			printk(" nothing: probe failed.\n");
 			return;
 		} else {
@@ -810,7 +804,7 @@ static int adjust_memory(struct pcmcia_socket *s, unsigned int action, unsigned
 static int adjust_io(struct pcmcia_socket *s, unsigned int action, unsigned long start, unsigned long end)
 {
 	struct socket_data *data = s->resource_data;
-	unsigned long size;
+	unsigned long size = end - start + 1;
 	int ret = 0;
 
 #if defined(CONFIG_X86)
@@ -820,8 +814,6 @@ static int adjust_io(struct pcmcia_socket *s, unsigned int action, unsigned long
 		start = 0x100;
 #endif
 
-	size = end - start + 1;
-
 	if (end < start)
 		return -EINVAL;
 
diff --git a/trunk/drivers/regulator/mc13783-regulator.c b/trunk/drivers/regulator/mc13783-regulator.c
index ad036dd8da13..a681f5e8f786 100644
--- a/trunk/drivers/regulator/mc13783-regulator.c
+++ b/trunk/drivers/regulator/mc13783-regulator.c
@@ -618,12 +618,9 @@ static int __devexit mc13783_regulator_remove(struct platform_device *pdev)
 		dev_get_platdata(&pdev->dev);
 	int i;
 
-	platform_set_drvdata(pdev, NULL);
-
 	for (i = 0; i < pdata->num_regulators; i++)
 		regulator_unregister(priv->regulators[i]);
 
-	kfree(priv);
 	return 0;
 }
 
diff --git a/trunk/drivers/serial/mcf.c b/trunk/drivers/serial/mcf.c
index b5aaef965f24..7bb5fee639e3 100644
--- a/trunk/drivers/serial/mcf.c
+++ b/trunk/drivers/serial/mcf.c
@@ -263,7 +263,6 @@ static void mcf_set_termios(struct uart_port *port, struct ktermios *termios,
 	}
 
 	spin_lock_irqsave(&port->lock, flags);
-	uart_update_timeout(port, termios->c_cflag, baud);
 	writeb(MCFUART_UCR_CMDRESETRX, port->membase + MCFUART_UCR);
 	writeb(MCFUART_UCR_CMDRESETTX, port->membase + MCFUART_UCR);
 	writeb(MCFUART_UCR_CMDRESETMRPTR, port->membase + MCFUART_UCR);
@@ -380,7 +379,6 @@ static irqreturn_t mcf_interrupt(int irq, void *data)
 static void mcf_config_port(struct uart_port *port, int flags)
 {
 	port->type = PORT_MCF;
-	port->fifosize = MCFUART_TXFIFOSIZE;
 
 	/* Clear mask, so no surprise interrupts. */
 	writeb(0, port->membase + MCFUART_UIMR);
@@ -426,7 +424,7 @@ static int mcf_verify_port(struct uart_port *port, struct serial_struct *ser)
 /*
  *	Define the basic serial functions we support.
  */
-static const struct uart_ops mcf_uart_ops = {
+static struct uart_ops mcf_uart_ops = {
 	.tx_empty	= mcf_tx_empty,
 	.get_mctrl	= mcf_get_mctrl,
 	.set_mctrl	= mcf_set_mctrl,
@@ -445,7 +443,7 @@ static const struct uart_ops mcf_uart_ops = {
 	.verify_port	= mcf_verify_port,
 };
 
-static struct mcf_uart mcf_ports[4];
+static struct mcf_uart mcf_ports[3];
 
 #define	MCF_MAXPORTS	ARRAY_SIZE(mcf_ports)
 
diff --git a/trunk/drivers/serial/serial_cs.c b/trunk/drivers/serial/serial_cs.c
index 8cfa5b12ea7a..175d202ab37e 100644
--- a/trunk/drivers/serial/serial_cs.c
+++ b/trunk/drivers/serial/serial_cs.c
@@ -105,10 +105,6 @@ struct serial_cfg_mem {
  * manfid 0x0160, 0x0104
  * This card appears to have a 14.7456MHz clock.
  */
-/* Generic Modem: MD55x (GPRS/EDGE) have
- * Elan VPU16551 UART with 14.7456MHz oscillator
- * manfid 0x015D, 0x4C45
- */
 static void quirk_setup_brainboxes_0104(struct pcmcia_device *link, struct uart_port *port)
 {
 	port->uartclk = 14745600;
@@ -199,11 +195,6 @@ static const struct serial_quirk quirks[] = {
 		.prodid	= 0x0104,
 		.multi	= -1,
 		.setup	= quirk_setup_brainboxes_0104,
-	}, {
-		.manfid	= 0x015D,
-		.prodid	= 0x4C45,
-		.multi	= -1,
-		.setup	= quirk_setup_brainboxes_0104,
 	}, {
 		.manfid	= MANFID_IBM,
 		.prodid	= ~0,
diff --git a/trunk/drivers/staging/dt3155/dt3155_drv.c b/trunk/drivers/staging/dt3155/dt3155_drv.c
index e2c44ec6fc45..a67c622869d2 100644
--- a/trunk/drivers/staging/dt3155/dt3155_drv.c
+++ b/trunk/drivers/staging/dt3155/dt3155_drv.c
@@ -57,8 +57,19 @@ MA 02111-1307 USA
 
 extern void printques(int);
 
+#ifdef MODULE
 #include <linux/module.h>
 #include <linux/interrupt.h>
+
+
+MODULE_LICENSE("GPL");
+
+#endif
+
+#ifndef CONFIG_PCI
+#error  "DT3155 :  Kernel PCI support not enabled (DT3155 drive requires PCI)"
+#endif
+
 #include <linux/pci.h>
 #include <linux/types.h>
 #include <linux/poll.h>
@@ -73,9 +84,6 @@ extern void printques(int);
 #include "dt3155_io.h"
 #include "allocator.h"
 
-
-MODULE_LICENSE("GPL");
-
 /* Error variable.  Zero means no error. */
 int dt3155_errno = 0;
 
diff --git a/trunk/fs/afs/mntpt.c b/trunk/fs/afs/mntpt.c
index b3feddc4f7d6..5e813a816ce4 100644
--- a/trunk/fs/afs/mntpt.c
+++ b/trunk/fs/afs/mntpt.c
@@ -138,9 +138,9 @@ static struct vfsmount *afs_mntpt_do_automount(struct dentry *mntpt)
 {
 	struct afs_super_info *super;
 	struct vfsmount *mnt;
-	struct page *page;
+	struct page *page = NULL;
 	size_t size;
-	char *buf, *devname, *options;
+	char *buf, *devname = NULL, *options = NULL;
 	int ret;
 
 	_enter("{%s}", mntpt->d_name.name);
@@ -150,22 +150,22 @@ static struct vfsmount *afs_mntpt_do_automount(struct dentry *mntpt)
 	ret = -EINVAL;
 	size = mntpt->d_inode->i_size;
 	if (size > PAGE_SIZE - 1)
-		goto error_no_devname;
+		goto error;
 
 	ret = -ENOMEM;
 	devname = (char *) get_zeroed_page(GFP_KERNEL);
 	if (!devname)
-		goto error_no_devname;
+		goto error;
 
 	options = (char *) get_zeroed_page(GFP_KERNEL);
 	if (!options)
-		goto error_no_options;
+		goto error;
 
 	/* read the contents of the AFS special symlink */
 	page = read_mapping_page(mntpt->d_inode->i_mapping, 0, NULL);
 	if (IS_ERR(page)) {
 		ret = PTR_ERR(page);
-		goto error_no_page;
+		goto error;
 	}
 
 	ret = -EIO;
@@ -196,12 +196,12 @@ static struct vfsmount *afs_mntpt_do_automount(struct dentry *mntpt)
 	return mnt;
 
 error:
-	page_cache_release(page);
-error_no_page:
-	free_page((unsigned long) options);
-error_no_options:
-	free_page((unsigned long) devname);
-error_no_devname:
+	if (page)
+		page_cache_release(page);
+	if (devname)
+		free_page((unsigned long) devname);
+	if (options)
+		free_page((unsigned long) options);
 	_leave(" = %d", ret);
 	return ERR_PTR(ret);
 }
diff --git a/trunk/fs/binfmt_flat.c b/trunk/fs/binfmt_flat.c
index 49566c1687d8..e0e769bdca59 100644
--- a/trunk/fs/binfmt_flat.c
+++ b/trunk/fs/binfmt_flat.c
@@ -355,7 +355,7 @@ calc_reloc(unsigned long r, struct lib_info *p, int curid, int internalp)
 
 	if (!flat_reloc_valid(r, start_brk - start_data + text_len)) {
 		printk("BINFMT_FLAT: reloc outside program 0x%x (0 - 0x%x/0x%x)",
-		       (int) r,(int)(start_brk-start_data+text_len),(int)text_len);
+		       (int) r,(int)(start_brk-start_code),(int)text_len);
 		goto failed;
 	}
 
diff --git a/trunk/fs/jfs/inode.c b/trunk/fs/jfs/inode.c
index ed9ba6fe04f5..9dd126276c9f 100644
--- a/trunk/fs/jfs/inode.c
+++ b/trunk/fs/jfs/inode.c
@@ -61,7 +61,7 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
 			inode->i_op = &page_symlink_inode_operations;
 			inode->i_mapping->a_ops = &jfs_aops;
 		} else {
-			inode->i_op = &jfs_fast_symlink_inode_operations;
+			inode->i_op = &jfs_symlink_inode_operations;
 			/*
 			 * The inline data should be null-terminated, but
 			 * don't let on-disk corruption crash the kernel
diff --git a/trunk/fs/jfs/jfs_dmap.c b/trunk/fs/jfs/jfs_dmap.c
index 9e2f6a721668..6c4dfcbf3f55 100644
--- a/trunk/fs/jfs/jfs_dmap.c
+++ b/trunk/fs/jfs/jfs_dmap.c
@@ -196,7 +196,7 @@ int dbMount(struct inode *ipbmap)
 	bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag);
 	bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref);
 	bmp->db_aglevel = le32_to_cpu(dbmp_le->dn_aglevel);
-	bmp->db_agheight = le32_to_cpu(dbmp_le->dn_agheight);
+	bmp->db_agheigth = le32_to_cpu(dbmp_le->dn_agheigth);
 	bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth);
 	bmp->db_agstart = le32_to_cpu(dbmp_le->dn_agstart);
 	bmp->db_agl2size = le32_to_cpu(dbmp_le->dn_agl2size);
@@ -288,7 +288,7 @@ int dbSync(struct inode *ipbmap)
 	dbmp_le->dn_maxag = cpu_to_le32(bmp->db_maxag);
 	dbmp_le->dn_agpref = cpu_to_le32(bmp->db_agpref);
 	dbmp_le->dn_aglevel = cpu_to_le32(bmp->db_aglevel);
-	dbmp_le->dn_agheight = cpu_to_le32(bmp->db_agheight);
+	dbmp_le->dn_agheigth = cpu_to_le32(bmp->db_agheigth);
 	dbmp_le->dn_agwidth = cpu_to_le32(bmp->db_agwidth);
 	dbmp_le->dn_agstart = cpu_to_le32(bmp->db_agstart);
 	dbmp_le->dn_agl2size = cpu_to_le32(bmp->db_agl2size);
@@ -1441,7 +1441,7 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results)
 	 * tree index of this allocation group within the control page.
 	 */
 	agperlev =
-	    (1 << (L2LPERCTL - (bmp->db_agheight << 1))) / bmp->db_agwidth;
+	    (1 << (L2LPERCTL - (bmp->db_agheigth << 1))) / bmp->db_agwidth;
 	ti = bmp->db_agstart + bmp->db_agwidth * (agno & (agperlev - 1));
 
 	/* dmap control page trees fan-out by 4 and a single allocation
@@ -1460,7 +1460,7 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results)
 		 * the subtree to find the leftmost leaf that describes this
 		 * free space.
 		 */
-		for (k = bmp->db_agheight; k > 0; k--) {
+		for (k = bmp->db_agheigth; k > 0; k--) {
 			for (n = 0, m = (ti << 2) + 1; n < 4; n++) {
 				if (l2nb <= dcp->stree[m + n]) {
 					ti = m + n;
@@ -3607,7 +3607,7 @@ void dbFinalizeBmap(struct inode *ipbmap)
 	}
 
 	/*
-	 * compute db_aglevel, db_agheight, db_width, db_agstart:
+	 * compute db_aglevel, db_agheigth, db_width, db_agstart:
 	 * an ag is covered in aglevel dmapctl summary tree,
 	 * at agheight level height (from leaf) with agwidth number of nodes
 	 * each, which starts at agstart index node of the smmary tree node
@@ -3616,9 +3616,9 @@ void dbFinalizeBmap(struct inode *ipbmap)
 	bmp->db_aglevel = BMAPSZTOLEV(bmp->db_agsize);
 	l2nl =
 	    bmp->db_agl2size - (L2BPERDMAP + bmp->db_aglevel * L2LPERCTL);
-	bmp->db_agheight = l2nl >> 1;
-	bmp->db_agwidth = 1 << (l2nl - (bmp->db_agheight << 1));
-	for (i = 5 - bmp->db_agheight, bmp->db_agstart = 0, n = 1; i > 0;
+	bmp->db_agheigth = l2nl >> 1;
+	bmp->db_agwidth = 1 << (l2nl - (bmp->db_agheigth << 1));
+	for (i = 5 - bmp->db_agheigth, bmp->db_agstart = 0, n = 1; i > 0;
 	     i--) {
 		bmp->db_agstart += n;
 		n <<= 2;
diff --git a/trunk/fs/jfs/jfs_dmap.h b/trunk/fs/jfs/jfs_dmap.h
index 6dcb906c55d8..1a6eb41569bc 100644
--- a/trunk/fs/jfs/jfs_dmap.h
+++ b/trunk/fs/jfs/jfs_dmap.h
@@ -210,7 +210,7 @@ struct dbmap_disk {
 	__le32 dn_maxag;	/* 4: max active alloc group number	*/
 	__le32 dn_agpref;	/* 4: preferred alloc group (hint)	*/
 	__le32 dn_aglevel;	/* 4: dmapctl level holding the AG	*/
-	__le32 dn_agheight;	/* 4: height in dmapctl of the AG	*/
+	__le32 dn_agheigth;	/* 4: height in dmapctl of the AG	*/
 	__le32 dn_agwidth;	/* 4: width in dmapctl of the AG	*/
 	__le32 dn_agstart;	/* 4: start tree index at AG height	*/
 	__le32 dn_agl2size;	/* 4: l2 num of blks per alloc group	*/
@@ -229,7 +229,7 @@ struct dbmap {
 	int dn_maxag;		/* max active alloc group number	*/
 	int dn_agpref;		/* preferred alloc group (hint)		*/
 	int dn_aglevel;		/* dmapctl level holding the AG		*/
-	int dn_agheight;	/* height in dmapctl of the AG		*/
+	int dn_agheigth;	/* height in dmapctl of the AG		*/
 	int dn_agwidth;		/* width in dmapctl of the AG		*/
 	int dn_agstart;		/* start tree index at AG height	*/
 	int dn_agl2size;	/* l2 num of blks per alloc group	*/
@@ -255,7 +255,7 @@ struct bmap {
 #define	db_agsize	db_bmap.dn_agsize
 #define	db_agl2size	db_bmap.dn_agl2size
 #define	db_agwidth	db_bmap.dn_agwidth
-#define	db_agheight	db_bmap.dn_agheight
+#define	db_agheigth	db_bmap.dn_agheigth
 #define	db_agstart	db_bmap.dn_agstart
 #define	db_numag	db_bmap.dn_numag
 #define	db_maxlevel	db_bmap.dn_maxlevel
diff --git a/trunk/fs/jfs/jfs_inode.h b/trunk/fs/jfs/jfs_inode.h
index 9e6bda30a6e8..79e2c79661df 100644
--- a/trunk/fs/jfs/jfs_inode.h
+++ b/trunk/fs/jfs/jfs_inode.h
@@ -48,6 +48,5 @@ extern const struct file_operations jfs_dir_operations;
 extern const struct inode_operations jfs_file_inode_operations;
 extern const struct file_operations jfs_file_operations;
 extern const struct inode_operations jfs_symlink_inode_operations;
-extern const struct inode_operations jfs_fast_symlink_inode_operations;
 extern const struct dentry_operations jfs_ci_dentry_operations;
 #endif				/* _H_JFS_INODE */
diff --git a/trunk/fs/jfs/namei.c b/trunk/fs/jfs/namei.c
index a9cf8e8675be..4a3e9f39c21d 100644
--- a/trunk/fs/jfs/namei.c
+++ b/trunk/fs/jfs/namei.c
@@ -956,7 +956,7 @@ static int jfs_symlink(struct inode *dip, struct dentry *dentry,
 	 */
 
 	if (ssize <= IDATASIZE) {
-		ip->i_op = &jfs_fast_symlink_inode_operations;
+		ip->i_op = &jfs_symlink_inode_operations;
 
 		i_fastsymlink = JFS_IP(ip)->i_inline;
 		memcpy(i_fastsymlink, name, ssize);
@@ -978,7 +978,7 @@ static int jfs_symlink(struct inode *dip, struct dentry *dentry,
 	else {
 		jfs_info("jfs_symlink: allocate extent ip:0x%p", ip);
 
-		ip->i_op = &jfs_symlink_inode_operations;
+		ip->i_op = &page_symlink_inode_operations;
 		ip->i_mapping->a_ops = &jfs_aops;
 
 		/*
diff --git a/trunk/fs/jfs/resize.c b/trunk/fs/jfs/resize.c
index 1aba0039f1c9..7f24a0bb08ca 100644
--- a/trunk/fs/jfs/resize.c
+++ b/trunk/fs/jfs/resize.c
@@ -81,7 +81,6 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
 	struct inode *iplist[1];
 	struct jfs_superblock *j_sb, *j_sb2;
 	uint old_agsize;
-	int agsizechanged = 0;
 	struct buffer_head *bh, *bh2;
 
 	/* If the volume hasn't grown, get out now */
@@ -334,9 +333,6 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
 	 */
 	if ((rc = dbExtendFS(ipbmap, XAddress, nblocks)))
 		goto error_out;
-
-	agsizechanged |= (bmp->db_agsize != old_agsize);
-
 	/*
 	 * the map now has extended to cover additional nblocks:
 	 * dn_mapsize = oldMapsize + nblocks;
@@ -436,7 +432,7 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
 	 * will correctly identify the new ag);
 	 */
 	/* if new AG size the same as old AG size, done! */
-	if (agsizechanged) {
+	if (bmp->db_agsize != old_agsize) {
 		if ((rc = diExtendFS(ipimap, ipbmap)))
 			goto error_out;
 
diff --git a/trunk/fs/jfs/symlink.c b/trunk/fs/jfs/symlink.c
index 205b946d8e0d..4af1a05aad0a 100644
--- a/trunk/fs/jfs/symlink.c
+++ b/trunk/fs/jfs/symlink.c
@@ -29,21 +29,9 @@ static void *jfs_follow_link(struct dentry *dentry, struct nameidata *nd)
 	return NULL;
 }
 
-const struct inode_operations jfs_fast_symlink_inode_operations = {
-	.readlink	= generic_readlink,
-	.follow_link	= jfs_follow_link,
-	.setattr	= jfs_setattr,
-	.setxattr	= jfs_setxattr,
-	.getxattr	= jfs_getxattr,
-	.listxattr	= jfs_listxattr,
-	.removexattr	= jfs_removexattr,
-};
-
 const struct inode_operations jfs_symlink_inode_operations = {
 	.readlink	= generic_readlink,
-	.follow_link	= page_follow_link_light,
-	.put_link	= page_put_link,
-	.setattr	= jfs_setattr,
+	.follow_link	= jfs_follow_link,
 	.setxattr	= jfs_setxattr,
 	.getxattr	= jfs_getxattr,
 	.listxattr	= jfs_listxattr,
diff --git a/trunk/fs/logfs/gc.c b/trunk/fs/logfs/gc.c
index 76c242fbe1b0..84e36f52fe95 100644
--- a/trunk/fs/logfs/gc.c
+++ b/trunk/fs/logfs/gc.c
@@ -459,14 +459,6 @@ static void __logfs_gc_pass(struct super_block *sb, int target)
 	struct logfs_block *block;
 	int round, progress, last_progress = 0;
 
-	/*
-	 * Doing too many changes to the segfile at once would result
-	 * in a large number of aliases.  Write the journal before
-	 * things get out of hand.
-	 */
-	if (super->s_shadow_tree.no_shadowed_segments >= MAX_OBJ_ALIASES)
-		logfs_write_anchor(sb);
-
 	if (no_free_segments(sb) >= target &&
 			super->s_no_object_aliases < MAX_OBJ_ALIASES)
 		return;
diff --git a/trunk/fs/logfs/journal.c b/trunk/fs/logfs/journal.c
index fb0a613f885b..33bd260b8309 100644
--- a/trunk/fs/logfs/journal.c
+++ b/trunk/fs/logfs/journal.c
@@ -389,10 +389,7 @@ static void journal_get_erase_count(struct logfs_area *area)
 static int journal_erase_segment(struct logfs_area *area)
 {
 	struct super_block *sb = area->a_sb;
-	union {
-		struct logfs_segment_header sh;
-		unsigned char c[ALIGN(sizeof(struct logfs_segment_header), 16)];
-	} u;
+	struct logfs_segment_header sh;
 	u64 ofs;
 	int err;
 
@@ -400,21 +397,20 @@ static int journal_erase_segment(struct logfs_area *area)
 	if (err)
 		return err;
 
-	memset(&u, 0, sizeof(u));
-	u.sh.pad = 0;
-	u.sh.type = SEG_JOURNAL;
-	u.sh.level = 0;
-	u.sh.segno = cpu_to_be32(area->a_segno);
-	u.sh.ec = cpu_to_be32(area->a_erase_count);
-	u.sh.gec = cpu_to_be64(logfs_super(sb)->s_gec);
-	u.sh.crc = logfs_crc32(&u.sh, sizeof(u.sh), 4);
+	sh.pad = 0;
+	sh.type = SEG_JOURNAL;
+	sh.level = 0;
+	sh.segno = cpu_to_be32(area->a_segno);
+	sh.ec = cpu_to_be32(area->a_erase_count);
+	sh.gec = cpu_to_be64(logfs_super(sb)->s_gec);
+	sh.crc = logfs_crc32(&sh, sizeof(sh), 4);
 
 	/* This causes a bug in segment.c.  Not yet. */
 	//logfs_set_segment_erased(sb, area->a_segno, area->a_erase_count, 0);
 
 	ofs = dev_ofs(sb, area->a_segno, 0);
-	area->a_used_bytes = sizeof(u);
-	logfs_buf_write(area, ofs, &u, sizeof(u));
+	area->a_used_bytes = ALIGN(sizeof(sh), 16);
+	logfs_buf_write(area, ofs, &sh, sizeof(sh));
 	return 0;
 }
 
@@ -498,8 +494,6 @@ static void account_shadows(struct super_block *sb)
 
 	btree_grim_visitor64(&tree->new, (unsigned long)sb, account_shadow);
 	btree_grim_visitor64(&tree->old, (unsigned long)sb, account_shadow);
-	btree_grim_visitor32(&tree->segment_map, 0, NULL);
-	tree->no_shadowed_segments = 0;
 
 	if (li->li_block) {
 		/*
@@ -613,9 +607,9 @@ static size_t __logfs_write_je(struct super_block *sb, void *buf, u16 type,
 	if (len == 0)
 		return logfs_write_header(super, header, 0, type);
 
-	BUG_ON(len > sb->s_blocksize);
 	compr_len = logfs_compress(buf, data, len, sb->s_blocksize);
 	if (compr_len < 0 || type == JE_ANCHOR) {
+		BUG_ON(len > sb->s_blocksize);
 		memcpy(data, buf, len);
 		compr_len = len;
 		compr = COMPR_NONE;
@@ -667,7 +661,6 @@ static int logfs_write_je_buf(struct super_block *sb, void *buf, u16 type,
 	if (ofs < 0)
 		return ofs;
 	logfs_buf_write(area, ofs, super->s_compressed_je, len);
-	BUG_ON(super->s_no_je >= MAX_JOURNAL_ENTRIES);
 	super->s_je_array[super->s_no_je++] = cpu_to_be64(ofs);
 	return 0;
 }
diff --git a/trunk/fs/logfs/logfs.h b/trunk/fs/logfs/logfs.h
index 0a3df1a0c936..b84b0eec6024 100644
--- a/trunk/fs/logfs/logfs.h
+++ b/trunk/fs/logfs/logfs.h
@@ -257,14 +257,10 @@ struct logfs_shadow {
  * struct shadow_tree
  * @new:			shadows where old_ofs==0, indexed by new_ofs
  * @old:			shadows where old_ofs!=0, indexed by old_ofs
- * @segment_map:		bitfield of segments containing shadows
- * @no_shadowed_segment:	number of segments containing shadows
  */
 struct shadow_tree {
 	struct btree_head64 new;
 	struct btree_head64 old;
-	struct btree_head32 segment_map;
-	int no_shadowed_segments;
 };
 
 struct object_alias_item {
@@ -309,14 +305,13 @@ typedef int write_alias_t(struct super_block *sb, u64 ino, u64 bix,
 		level_t level, int child_no, __be64 val);
 struct logfs_block_ops {
 	void	(*write_block)(struct logfs_block *block);
+	gc_level_t	(*block_level)(struct logfs_block *block);
 	void	(*free_block)(struct super_block *sb, struct logfs_block*block);
 	int	(*write_alias)(struct super_block *sb,
 			struct logfs_block *block,
 			write_alias_t *write_one_alias);
 };
 
-#define MAX_JOURNAL_ENTRIES 256
-
 struct logfs_super {
 	struct mtd_info *s_mtd;			/* underlying device */
 	struct block_device *s_bdev;		/* underlying device */
@@ -383,7 +378,7 @@ struct logfs_super {
 	u32	 s_journal_ec[LOGFS_JOURNAL_SEGS]; /* journal erasecounts */
 	u64	 s_last_version;
 	struct logfs_area *s_journal_area;	/* open journal segment */
-	__be64	s_je_array[MAX_JOURNAL_ENTRIES];
+	__be64	s_je_array[64];
 	int	s_no_je;
 
 	int	 s_sum_index;			/* for the 12 summaries */
@@ -727,10 +722,4 @@ static inline struct logfs_area *get_area(struct super_block *sb,
 	return logfs_super(sb)->s_area[(__force u8)gc_level];
 }
 
-static inline void logfs_mempool_destroy(mempool_t *pool)
-{
-	if (pool)
-		mempool_destroy(pool);
-}
-
 #endif
diff --git a/trunk/fs/logfs/readwrite.c b/trunk/fs/logfs/readwrite.c
index 3159db6958e5..bff40253dfb2 100644
--- a/trunk/fs/logfs/readwrite.c
+++ b/trunk/fs/logfs/readwrite.c
@@ -430,6 +430,25 @@ static void inode_write_block(struct logfs_block *block)
 	}
 }
 
+static gc_level_t inode_block_level(struct logfs_block *block)
+{
+	BUG_ON(block->inode->i_ino == LOGFS_INO_MASTER);
+	return GC_LEVEL(LOGFS_MAX_LEVELS);
+}
+
+static gc_level_t indirect_block_level(struct logfs_block *block)
+{
+	struct page *page;
+	struct inode *inode;
+	u64 bix;
+	level_t level;
+
+	page = block->page;
+	inode = page->mapping->host;
+	logfs_unpack_index(page->index, &bix, &level);
+	return expand_level(inode->i_ino, level);
+}
+
 /*
  * This silences a false, yet annoying gcc warning.  I hate it when my editor
  * jumps into bitops.h each time I recompile this file.
@@ -568,12 +587,14 @@ static void indirect_free_block(struct super_block *sb,
 
 static struct logfs_block_ops inode_block_ops = {
 	.write_block = inode_write_block,
+	.block_level = inode_block_level,
 	.free_block = inode_free_block,
 	.write_alias = inode_write_alias,
 };
 
 struct logfs_block_ops indirect_block_ops = {
 	.write_block = indirect_write_block,
+	.block_level = indirect_block_level,
 	.free_block = indirect_free_block,
 	.write_alias = indirect_write_alias,
 };
@@ -1220,18 +1241,6 @@ static void free_shadow(struct inode *inode, struct logfs_shadow *shadow)
 	mempool_free(shadow, super->s_shadow_pool);
 }
 
-static void mark_segment(struct shadow_tree *tree, u32 segno)
-{
-	int err;
-
-	if (!btree_lookup32(&tree->segment_map, segno)) {
-		err = btree_insert32(&tree->segment_map, segno, (void *)1,
-				GFP_NOFS);
-		BUG_ON(err);
-		tree->no_shadowed_segments++;
-	}
-}
-
 /**
  * fill_shadow_tree - Propagate shadow tree changes due to a write
  * @inode:	Inode owning the page
@@ -1279,8 +1288,6 @@ static void fill_shadow_tree(struct inode *inode, struct page *page,
 
 		super->s_dirty_used_bytes += shadow->new_len;
 		super->s_dirty_free_bytes += shadow->old_len;
-		mark_segment(tree, shadow->old_ofs >> super->s_segshift);
-		mark_segment(tree, shadow->new_ofs >> super->s_segshift);
 	}
 }
 
@@ -1838,37 +1845,19 @@ static int __logfs_truncate(struct inode *inode, u64 size)
 	return logfs_truncate_direct(inode, size);
 }
 
-/*
- * Truncate, by changing the segment file, can consume a fair amount
- * of resources.  So back off from time to time and do some GC.
- * 8 or 2048 blocks should be well within safety limits even if
- * every single block resided in a different segment.
- */
-#define TRUNCATE_STEP	(8 * 1024 * 1024)
-int logfs_truncate(struct inode *inode, u64 target)
+int logfs_truncate(struct inode *inode, u64 size)
 {
 	struct super_block *sb = inode->i_sb;
-	u64 size = i_size_read(inode);
-	int err = 0;
+	int err;
 
-	size = ALIGN(size, TRUNCATE_STEP);
-	while (size > target) {
-		if (size > TRUNCATE_STEP)
-			size -= TRUNCATE_STEP;
-		else
-			size = 0;
-		if (size < target)
-			size = target;
-
-		logfs_get_wblocks(sb, NULL, 1);
-		err = __logfs_truncate(inode, target);
-		if (!err)
-			err = __logfs_write_inode(inode, 0);
-		logfs_put_wblocks(sb, NULL, 1);
-	}
+	logfs_get_wblocks(sb, NULL, 1);
+	err = __logfs_truncate(inode, size);
+	if (!err)
+		err = __logfs_write_inode(inode, 0);
+	logfs_put_wblocks(sb, NULL, 1);
 
 	if (!err)
-		err = vmtruncate(inode, target);
+		err = vmtruncate(inode, size);
 
 	/* I don't trust error recovery yet. */
 	WARN_ON(err);
@@ -2262,6 +2251,8 @@ void logfs_cleanup_rw(struct super_block *sb)
 	struct logfs_super *super = logfs_super(sb);
 
 	destroy_meta_inode(super->s_segfile_inode);
-	logfs_mempool_destroy(super->s_block_pool);
-	logfs_mempool_destroy(super->s_shadow_pool);
+	if (super->s_block_pool)
+		mempool_destroy(super->s_block_pool);
+	if (super->s_shadow_pool)
+		mempool_destroy(super->s_shadow_pool);
 }
diff --git a/trunk/fs/logfs/segment.c b/trunk/fs/logfs/segment.c
index f77ce2b470ba..801a3a141625 100644
--- a/trunk/fs/logfs/segment.c
+++ b/trunk/fs/logfs/segment.c
@@ -183,8 +183,14 @@ static int btree_write_alias(struct super_block *sb, struct logfs_block *block,
 	return 0;
 }
 
+static gc_level_t btree_block_level(struct logfs_block *block)
+{
+	return expand_level(block->ino, block->level);
+}
+
 static struct logfs_block_ops btree_block_ops = {
 	.write_block	= btree_write_block,
+	.block_level	= btree_block_level,
 	.free_block	= __free_block,
 	.write_alias	= btree_write_alias,
 };
@@ -913,7 +919,7 @@ int logfs_init_areas(struct super_block *sb)
 	for (i--; i >= 0; i--)
 		free_area(super->s_area[i]);
 	free_area(super->s_journal_area);
-	logfs_mempool_destroy(super->s_alias_pool);
+	mempool_destroy(super->s_alias_pool);
 	return -ENOMEM;
 }
 
diff --git a/trunk/fs/logfs/super.c b/trunk/fs/logfs/super.c
index 5866ee6e1327..b60bfac3263c 100644
--- a/trunk/fs/logfs/super.c
+++ b/trunk/fs/logfs/super.c
@@ -12,7 +12,6 @@
 #include "logfs.h"
 #include <linux/bio.h>
 #include <linux/slab.h>
-#include <linux/blkdev.h>
 #include <linux/mtd/mtd.h>
 #include <linux/statfs.h>
 #include <linux/buffer_head.h>
@@ -138,10 +137,6 @@ static int logfs_sb_set(struct super_block *sb, void *_super)
 	sb->s_fs_info = super;
 	sb->s_mtd = super->s_mtd;
 	sb->s_bdev = super->s_bdev;
-	if (sb->s_bdev)
-		sb->s_bdi = &bdev_get_queue(sb->s_bdev)->backing_dev_info;
-	if (sb->s_mtd)
-		sb->s_bdi = sb->s_mtd->backing_dev_info;
 	return 0;
 }
 
@@ -457,8 +452,6 @@ static int logfs_read_sb(struct super_block *sb, int read_only)
 
 	btree_init_mempool64(&super->s_shadow_tree.new, super->s_btree_pool);
 	btree_init_mempool64(&super->s_shadow_tree.old, super->s_btree_pool);
-	btree_init_mempool32(&super->s_shadow_tree.segment_map,
-			super->s_btree_pool);
 
 	ret = logfs_init_mapping(sb);
 	if (ret)
@@ -523,8 +516,8 @@ static void logfs_kill_sb(struct super_block *sb)
 	if (super->s_erase_page)
 		__free_page(super->s_erase_page);
 	super->s_devops->put_device(sb);
-	logfs_mempool_destroy(super->s_btree_pool);
-	logfs_mempool_destroy(super->s_alias_pool);
+	mempool_destroy(super->s_btree_pool);
+	mempool_destroy(super->s_alias_pool);
 	kfree(super);
 	log_super("LogFS: Finished unmounting\n");
 }
diff --git a/trunk/fs/quota/Kconfig b/trunk/fs/quota/Kconfig
index 3e21b1e2ad3a..dad7fb247ddc 100644
--- a/trunk/fs/quota/Kconfig
+++ b/trunk/fs/quota/Kconfig
@@ -33,14 +33,6 @@ config PRINT_QUOTA_WARNING
 	  Note that this behavior is currently deprecated and may go away in
 	  future. Please use notification via netlink socket instead.
 
-config QUOTA_DEBUG
-	bool "Additional quota sanity checks"
-	depends on QUOTA
-	default n
-	help
-	  If you say Y here, quota subsystem will perform some additional
-	  sanity checks of quota internal structures. If unsure, say N.
-
 # Generic support for tree structured quota files. Selected when needed.
 config QUOTA_TREE
 	 tristate
diff --git a/trunk/fs/quota/dquot.c b/trunk/fs/quota/dquot.c
index 788b5802a7ce..a0a9405b202a 100644
--- a/trunk/fs/quota/dquot.c
+++ b/trunk/fs/quota/dquot.c
@@ -80,6 +80,8 @@
 
 #include <asm/uaccess.h>
 
+#define __DQUOT_PARANOIA
+
 /*
  * There are three quota SMP locks. dq_list_lock protects all lists with quotas
  * and quota formats, dqstats structure containing statistics about the lists
@@ -693,7 +695,7 @@ void dqput(struct dquot *dquot)
 
 	if (!dquot)
 		return;
-#ifdef CONFIG_QUOTA_DEBUG
+#ifdef __DQUOT_PARANOIA
 	if (!atomic_read(&dquot->dq_count)) {
 		printk("VFS: dqput: trying to free free dquot\n");
 		printk("VFS: device %s, dquot of %s %d\n",
@@ -746,7 +748,7 @@ void dqput(struct dquot *dquot)
 		goto we_slept;
 	}
 	atomic_dec(&dquot->dq_count);
-#ifdef CONFIG_QUOTA_DEBUG
+#ifdef __DQUOT_PARANOIA
 	/* sanity check */
 	BUG_ON(!list_empty(&dquot->dq_free));
 #endif
@@ -843,7 +845,7 @@ struct dquot *dqget(struct super_block *sb, unsigned int id, int type)
 		dquot = NULL;
 		goto out;
 	}
-#ifdef CONFIG_QUOTA_DEBUG
+#ifdef __DQUOT_PARANOIA
 	BUG_ON(!dquot->dq_sb);	/* Has somebody invalidated entry under us? */
 #endif
 out:
@@ -872,7 +874,7 @@ static int dqinit_needed(struct inode *inode, int type)
 static void add_dquot_ref(struct super_block *sb, int type)
 {
 	struct inode *inode, *old_inode = NULL;
-#ifdef CONFIG_QUOTA_DEBUG
+#ifdef __DQUOT_PARANOIA
 	int reserved = 0;
 #endif
 
@@ -880,7 +882,7 @@ static void add_dquot_ref(struct super_block *sb, int type)
 	list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
 		if (inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE|I_NEW))
 			continue;
-#ifdef CONFIG_QUOTA_DEBUG
+#ifdef __DQUOT_PARANOIA
 		if (unlikely(inode_get_rsv_space(inode) > 0))
 			reserved = 1;
 #endif
@@ -905,7 +907,7 @@ static void add_dquot_ref(struct super_block *sb, int type)
 	spin_unlock(&inode_lock);
 	iput(old_inode);
 
-#ifdef CONFIG_QUOTA_DEBUG
+#ifdef __DQUOT_PARANOIA
 	if (reserved) {
 		printk(KERN_WARNING "VFS (%s): Writes happened before quota"
 			" was turned on thus quota information is probably "
@@ -938,7 +940,7 @@ static int remove_inode_dquot_ref(struct inode *inode, int type,
 	inode->i_dquot[type] = NULL;
 	if (dquot) {
 		if (dqput_blocks(dquot)) {
-#ifdef CONFIG_QUOTA_DEBUG
+#ifdef __DQUOT_PARANOIA
 			if (atomic_read(&dquot->dq_count) != 1)
 				printk(KERN_WARNING "VFS: Adding dquot with dq_count %d to dispose list.\n", atomic_read(&dquot->dq_count));
 #endif
diff --git a/trunk/include/linux/kvm_host.h b/trunk/include/linux/kvm_host.h
index 169d07758ee5..a3fd0f91d943 100644
--- a/trunk/include/linux/kvm_host.h
+++ b/trunk/include/linux/kvm_host.h
@@ -54,7 +54,7 @@ extern struct kmem_cache *kvm_vcpu_cache;
  */
 struct kvm_io_bus {
 	int                   dev_count;
-#define NR_IOBUS_DEVS 200
+#define NR_IOBUS_DEVS 6
 	struct kvm_io_device *devs[NR_IOBUS_DEVS];
 };
 
@@ -119,11 +119,6 @@ struct kvm_memory_slot {
 	int user_alloc;
 };
 
-static inline unsigned long kvm_dirty_bitmap_bytes(struct kvm_memory_slot *memslot)
-{
-	return ALIGN(memslot->npages, BITS_PER_LONG) / 8;
-}
-
 struct kvm_kernel_irq_routing_entry {
 	u32 gsi;
 	u32 type;
diff --git a/trunk/include/linux/regulator/consumer.h b/trunk/include/linux/regulator/consumer.h
index ebd747265294..28c9fd020d39 100644
--- a/trunk/include/linux/regulator/consumer.h
+++ b/trunk/include/linux/regulator/consumer.h
@@ -183,13 +183,9 @@ static inline struct regulator *__must_check regulator_get(struct device *dev,
 {
 	/* Nothing except the stubbed out regulator API should be
 	 * looking at the value except to check if it is an error
-	 * value. Drivers are free to handle NULL specifically by
-	 * skipping all regulator API calls, but they don't have to.
-	 * Drivers which don't, should make sure they properly handle
-	 * corner cases of the API, such as regulator_get_voltage()
-	 * returning 0.
+	 * value so the actual return value doesn't matter.
 	 */
-	return NULL;
+	return (struct regulator *)id;
 }
 static inline void regulator_put(struct regulator *regulator)
 {
diff --git a/trunk/kernel/cred.c b/trunk/kernel/cred.c
index 62af1816c235..e1dbe9eef800 100644
--- a/trunk/kernel/cred.c
+++ b/trunk/kernel/cred.c
@@ -398,8 +398,6 @@ struct cred *prepare_usermodehelper_creds(void)
 
 error:
 	put_cred(new);
-	return NULL;
-
 free_tgcred:
 #ifdef CONFIG_KEYS
 	kfree(tgcred);
@@ -793,6 +791,8 @@ bool creds_are_invalid(const struct cred *cred)
 {
 	if (cred->magic != CRED_MAGIC)
 		return true;
+	if (atomic_read(&cred->usage) < atomic_read(&cred->subscribers))
+		return true;
 #ifdef CONFIG_SECURITY_SELINUX
 	if (selinux_is_enabled()) {
 		if ((unsigned long) cred->security < PAGE_SIZE)
diff --git a/trunk/security/inode.c b/trunk/security/inode.c
index 1c812e874504..c3a793881d04 100644
--- a/trunk/security/inode.c
+++ b/trunk/security/inode.c
@@ -161,13 +161,13 @@ static int create_by_name(const char *name, mode_t mode,
 
 	mutex_lock(&parent->d_inode->i_mutex);
 	*dentry = lookup_one_len(name, parent, strlen(name));
-	if (!IS_ERR(*dentry)) {
+	if (!IS_ERR(dentry)) {
 		if ((mode & S_IFMT) == S_IFDIR)
 			error = mkdir(parent->d_inode, *dentry, mode);
 		else
 			error = create(parent->d_inode, *dentry, mode);
 	} else
-		error = PTR_ERR(*dentry);
+		error = PTR_ERR(dentry);
 	mutex_unlock(&parent->d_inode->i_mutex);
 
 	return error;
diff --git a/trunk/virt/kvm/kvm_main.c b/trunk/virt/kvm/kvm_main.c
index c82ae2492634..5a0cd194dce0 100644
--- a/trunk/virt/kvm/kvm_main.c
+++ b/trunk/virt/kvm/kvm_main.c
@@ -341,11 +341,7 @@ static void kvm_mmu_notifier_release(struct mmu_notifier *mn,
 				     struct mm_struct *mm)
 {
 	struct kvm *kvm = mmu_notifier_to_kvm(mn);
-	int idx;
-
-	idx = srcu_read_lock(&kvm->srcu);
 	kvm_arch_flush_shadow(kvm);
-	srcu_read_unlock(&kvm->srcu, idx);
 }
 
 static const struct mmu_notifier_ops kvm_mmu_notifier_ops = {
@@ -652,7 +648,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
 
 	/* Allocate page dirty bitmap if needed */
 	if ((new.flags & KVM_MEM_LOG_DIRTY_PAGES) && !new.dirty_bitmap) {
-		unsigned long dirty_bytes = kvm_dirty_bitmap_bytes(&new);
+		unsigned dirty_bytes = ALIGN(npages, BITS_PER_LONG) / 8;
 
 		new.dirty_bitmap = vmalloc(dirty_bytes);
 		if (!new.dirty_bitmap)
@@ -772,7 +768,7 @@ int kvm_get_dirty_log(struct kvm *kvm,
 {
 	struct kvm_memory_slot *memslot;
 	int r, i;
-	unsigned long n;
+	int n;
 	unsigned long any = 0;
 
 	r = -EINVAL;
@@ -784,7 +780,7 @@ int kvm_get_dirty_log(struct kvm *kvm,
 	if (!memslot->dirty_bitmap)
 		goto out;
 
-	n = kvm_dirty_bitmap_bytes(memslot);
+	n = ALIGN(memslot->npages, BITS_PER_LONG) / 8;
 
 	for (i = 0; !any && i < n/sizeof(long); ++i)
 		any = memslot->dirty_bitmap[i];
@@ -1190,13 +1186,10 @@ void mark_page_dirty(struct kvm *kvm, gfn_t gfn)
 	memslot = gfn_to_memslot_unaliased(kvm, gfn);
 	if (memslot && memslot->dirty_bitmap) {
 		unsigned long rel_gfn = gfn - memslot->base_gfn;
-		unsigned long *p = memslot->dirty_bitmap +
-					rel_gfn / BITS_PER_LONG;
-		int offset = rel_gfn % BITS_PER_LONG;
 
 		/* avoid RMW */
-		if (!generic_test_le_bit(offset, p))
-			generic___set_le_bit(offset, p);
+		if (!generic_test_le_bit(rel_gfn, memslot->dirty_bitmap))
+			generic___set_le_bit(rel_gfn, memslot->dirty_bitmap);
 	}
 }